A.A.A. Send ALERT LOG to QRADAR

[Laguna8899]

To forward events to an external destination, the QRADAR guide tells me to create a new custom configuration file on the handler at /opt/so/saltstack/local/salt/logstash/pipelines/config/custom/NANO NAMEFILE.CONF

the file I created for the situation I need is:

output {
if [module] =~ "suricata" and [dataset] =~ "alert" {
syslog {
host => "192.X.X.X"
port => 514
appname => "suricata"
protocol => "tcp"
}
}
}

in this way, however, I get ALL the LOGS.
I would like that only the "ALERT" LOGs that I have in my security onion are forwarded to my QRADAR?
how can I do? how should i edit the file? thank you

[dougburks]

Your title says Send CASE LOG but your description says "ALERT" LOGs. Which are you trying to send?

[Laguna8899]

Sorry, Alert logs

[dougburks]

Can you share an example of a non-alert log that is being forwarded?